Verifiable Secret Sharing as 
Secure Computation 

Rosario Gennaro Silvio Micali 

Laboratory for Computer Science 

Massachusetts Institute of Technology 
rosario , silvio@theory . lcs .mit . edu 

Abstract 

We present a stronger notion of verifiable secret sharing and exhibit a pro- 
tocol implementing it. We show that our new notion is preferable to the old 
ones whenever verifiable secret sharing is used as a tool within larger protocols, 
rather than being a goal in itself. 



1 Introduction 

Secret Sharing and Verifiable Secret Sharing (VSS for short) are fundamental notions 
and tools for secure cryptographic design. Despite the centrality and the maturity of 
this concept (almost f years passed from its original introduction), we shall advocate 
that a stronger and better definition of a VSS is needed. 

THE INTUITIVE NOTION OF A VSS. As hrst introduced by Chor, Goldwasser, Micali 
and Awerbuch in [3], a VSS protocol consists of a two-stage protocol. Informally, there 
are n players, t of which may be bad and deviate from their prescribed instructions. 
One of the players, the dealer, possesses a value s as a secret input. In the hrst stage, 
the dealer commits to a unique value v (no matter what the bad players may do); 
moreover, v = s whenever the dealer is honest. In the second stage, the already 
committed value v will be recovered by all good players (again, no matter what the 
bad players might do). 

PRIOR WORK. Several definitions and protocols for VSS have been proposed in 
the past ten years (E.g., [3, 1, 2, 4, 11].) We contend, however, that these notions 
and these protocols are of very limited use. In fact, their security concerns "begin 
when the dealer's secret is committed, and end when it is recovered." Because in 
many applications running a single VSS protocol is exactly what is wanted, these 
prior definitions and protocols are totally adequate in those scenarios. They are not, 
however, adequate in more general scenarios: when VSS is used as a tool towards 
other ends, that is, when it is used as a sub-protocol within a larger protocol. Indeed, 
and unfortunately, it is by now a well-known phenomenon that protocols that are 
secure by themselves, cease to be secure when used as a sub-protocols. (For instance, 
[4] used their VSS as a tool to reach Byzantine agreement, and thus had to argue that 
their overall protocol was secure "from scratch" rather than in a "modular way." Of 
course, such proofs from scratch tend to be overly long and complex.) 

OUR WORK. In this paper we put forward a definition of VSS that guarantees 
reducibility; that is, security even when VSS is used as a sub-routine in an otherwise 
secure protocol. A notion of security that guarantees reducibility has been presented 
by Micali and Rogaway [9], but for the problem of function evaluation. We thus wish 
to extend reducibility-guaranteeing notions of security to verifiable secret sharing 
protocols and concretely exhibit VSS protocols that provably satisfy these notions. 
More precisely, in this paper we achieve the following goals: 

1. We propose a new definition of VSS based on secure function evaluation 
(This will guarantee the reducibility that characterizes the latter notion.) 

2. We compare our new notion with the previously proposed ones, and show that 
it is strictly and inherently stronger. 

1 



(Indeed, though sometimes protocols proved to satisfy weaker properties also 
satisfy stronger ones, we shall also show that none of the previous VSS protocols 
can satisfy our new notion.) 

3. We modify an earlier VSS protocol of [1] and show that it is secure according 
to our notion. 



2 Prior work 

In order to focus on the difficulties that are proper of VSS, in this extended abstract 
we shall deal with a simple computational model, both when reviewing prior work 
and when presenting our new one. 

COMPUTATIONAL MODEL. We consider n players communicating via a very con- 
venient synchronous network. Namely, to avoid the use of Byzantine Agreement 
protocols we allow players to broadcast messages, and, in order to avoid the use of 
cryptography, we assume that each pair of players is connected by a private commu- 
nication channel (i.e., no adversary can interfere with or have any access to messages 
between good players). 

We model the corrupted processors as being coordinated by an adversary A. This 
adversary will be dynamic (i.e., decides during the execution of the protocol which 
processors corrupt); all-powerful: (i.e., can perform arbitrarily long computations); 
and completely-informed (i.e., when corrupting a player she finds out all his computa- 
tional history: private input, previous messages sent and received, coin tosses, etc.). 
Further, the adversary is also allowed rushing (i.e., in a given round of communica- 
tion, bad players receive messages before the good ones and, based on the messages 
received by the bad players, the adversary can decide whom to corrupt next). 

We say that such an adversary is a t-adversary ( < t < n ) if t is an upper bound 
on the number of processors she can corrupt it is also referred to as the fault-tolerance 
of the protocol.) 

This computational model is precisely discussed in [4] and [9]. 

PRIOR DEFINITIONS OF VSS To exactly capture the informal idea of a VSS, has 
proven to be an hard task in itself. The definition reviewed below is that of [4], which 
relies on the notion of a fixed event: 

Definition: We say that an event X is fixed at a given round in an execution E of a 
protocol, if X occurs in any execution E' of the protocol coinciding with E up to the 
given round. 

Definition 1 Let P be a pair of protocols where the second is always executed after 
the hrst one, P =(Share-Verify, Recover). In protocol Share-Verify, the identity 
of the dealer is a common input to all players, and the secret is a private input to 



the dealer; the output of player P 8 - is a value verificatiorii £ {yes, no]. In protocol 
Recover, the input of each player P 8 - is his computational history at the end of the 
previous execution of Share-Verify; the output of each P 8 - is a string <7 8 -. 

We say P is a VSS protocol with fault-tolerance t if the following 3 properties are 
satisfied: 

1. Acceptance of good secrets: In all executions of Share-Verify with a t-adversary 
A in which the dealer is good, verificatiorii = J/es for all good players P 8 -. 

2. Verifiability: If less than t players output verification = no at the end of 
Share-Verify then at this time a value a has been fixed and at the end of 
Recover all good players will output the same value a and moreover if the 
dealer is good a = the secret. 1 

3. Unpredictability In a random execution of Share-Verify with a good dealer 
and the secret chosen randomly in a set of cardinality m any t-adversary A 
won't be able to predict the secret better than at random i.e. if A outputs a 
number a at the end of Share-Verify then Prob[a = s] = — 



SECURE COMPUTATION. Let us summarize the definition of secure function evalu- 
ation of [9]. Informally the problem is the following: n players Pi, . . . ,P n , holding, 
respectively, private inputs x-±, . . . ,x n , want to evaluate a vector-valued function / 
on their individual secret inputs without revealing them (more than already implied 
by /'s output). That is, they want to compute (j/i, . . . , y n ) = f(xi, . . . , x n ) such that 
each player P 8 - will learn exactly j/ 8 -. 

This goal is easily achievable if there is an external and trusted party, who pri- 
vately receives all individual inputs and then computes and privately hands out all 
individual outputs. Of course, even in this ideal scenario, the adversary can create 
some problems. She can corrupt a player P 8 - before he gives his input X{ to the exter- 
nal party and change it with some other number X{. And she can still corrupt players 
after the function has been evaluated and learn their outputs. These problems should, 
however, be regarded as inevitable. Indeed, following [6], [9] call a protocol for eval- 
uating / secure if it approximates the above ideal scenario "as closely as possible." 
The nature of this approximation is informally summarized below. 

Definition (Initial configuration, traffic, input and output): Let us define the follow- 
ing quantities within the context of a protocol P. 

The initial configuration for P is a vector ic, whose zth component, zc 8 - = (x 8 ,r 8 ) 
consists of the private input and the random tape of player P 8 -. 



1 Notice that if we simply ask in the Verifiability condition that "all the good players output the 
same number a at the end of the Recover phase" it would not be sufficient for our purposes. In 
fact, we would still allow the adversary to decide during Recover what value a the good players will 
output. Thus Share-Verify would not model a secret commitment as required. 



The traffic of player P 8 - in protocol P at round q, t q i} is the set of messages sent and 
received by P 8 - up to that round. 

A local input function I = (Ji, . . . , I n ) for P is an n-tuple of functions such that there 
exists a specific round r such that, by applying p to the traffic t r i} we get the input 
player P 8 - is "contributing to the computation." I(ic) will denote the vector of those 
values when P is run on initial configuration ic. 

A local output function = (0\ } . . . , n ) for P is an n-tuple of functions such that 
by applying Oi to the final traffic tj ma of player P 8 - we get his output. 

Definition (Adversary view): The adversary view, VIEW$ e1 . work , during P is the 
probability distribution over the set of computational histories (traffic and coin tosses) 
of the bad players. 

Definition (Simulator and ideal evaluation oracle): A simulator Sim is an algorithm 
that "plays the role of the good players". The adversary interacts with the simulator 
as if she was interacting with the network. The simulator tries to create a view for the 
adversary that is indistinguishable from the real one. He does this without knowing 
the input of the players, but it is given access to a special oracle called the ideal 
evaluation oracle. For a protocol P with local input function / evaluatable at round 
r, the rules of the interaction between Sim and the oracle are the following: 

• if A corrupts player P 8 - before round r Sim gets from the oracle the input X{. 

• at round r Sim gets the output y[ for all the players corrupted so far, where 
(y[ } . . . , y' n ) = f(x' l7 . . . , x' n ) where x\ = X{ if P; is still good, otherwise x\ = P(t^) 

• if A corrupts a player P 8 - after round r, Sim gets from the oracle the pair (x 8 -, j/'). 

Definition 2 (secure function evaluation) 

Let / be a vector- valued function, P a protocol, Sim a simulator, and I and O local 

input and output functions. We say that P securely evaluates the function / if 

• Correctness: If ic is the initial configuration of the network, then 

1. Xi = Ii(ic) for all good players P 8 - 

2. with high probability, 0(t final ) = f(I(fc)) 

(I.e. no matter what the adversary does, the function is evaluated during the 
protocol on some definite inputs defined by the local input functions over the 
traffic of the players. These inputs coincide with the original inputs for the 
good players) 



• Privacy: For all initial configurations ic, if V I EWg im is the adversary view of 
the simulated execution of the protocol, we have that 

VIEW$ etwork « VIEW* m 

(I.e., the two views are statistically indistinguishable.) 

There are many reasons for which this definition captures correctly the notion of a 
secure computation. In particular, the following one: the [9] definition allows one to 
prove formally many desirable properties of secure protocols, the most interesting for 
us being reducibility: 

Theorem 1 ([9]) Let f and g be two functions. Suppose there is a protocol P that 
securely evaluates f in the model of computation in which it can perform ideal evalu- 
ation of g. Suppose also that there is a protocol Q that securely computes g. Denote 
with P® the protocol in which the code for Q is substituted in P in the places where 
P ideally computes g. Then P® is secure. 

Interested readers are referred to the original (80-page!) paper [9] for a proof of this 
statement and a complete and a formal description of their definition. 

3 Our definition of VSS 

In this section we provide a new definition of VSS that guarantees reducibility. The 
key idea for achieving this property is to cast VSS in terms of secure function evalu- 
ation. Accordingly, we shall define two special functions SHAR and REC, and demand 
that both of them be securely evaluated in the sense of [9]. 

We assume a network of n players Pi, ... , P n -\ and P n} where P n = D the dealer. 

Let E = {0,1}*. Consider the vector space E n and the following metric on it: 
given two vectors a, b in E n , let us define the distance between them as the number 
of components in which they differ; that is, 

d(a,b) = \{l < i < n,ai ^ b % }\ 

We define the t-disc of a as the set of points at distance < t from a i.e. 

disc t {a) = {5eE B : d(a, b) < t} 

We will define again VSS as a pair of protocols, called Share-Verify and Recover, 
that compute, respectively, two functions, SHAR and REC, satisfying the following 
properties. 

SHAR is the function we use to share the secret among the players. It is defined 
on the entire space for the n — 1 players (their private input does not matter in this 



phase) and on two finite special sets R and S for the dealer. S is the space of possible 
secrets while R is a set of random strings. We will ask even after seeing any / shares 
(/ < t) all secrets are equally likely to generate those shares. We call this property 
t-uniformity (see 2 below). 

Similarly REC is the function we use to reconstruct the secret. We will run it on 
the output of the previous phase. What we want is that we will be able to do so even 
if up to t components of the output of the sharing process are arbitrarily changed. 
We call this property t-robustness of the function REC (see 3 below). 

Definition: We say that two functions SHAR and REC are a sharing-reconstructing 
pair with parameter t if they have the following properties: 

1. (Domain.) 

SHAR : E"" 1 x (R x S) -> E n 

and 

REC : E n -> E n 

2. (t-uniformity.) V7 < t there exists an integer n\ such that V s 8l , . . . , s 8 - ; £ E and 
V Ui, . . . , v n _i £ E, V s £ S, and \/x £ E n such that Vj £ [1, /] X{ = s 8 - , there 
exist exactly n\ values ri, . . . , r ni £ R such that for i = 1, . . . , n/, 

SHAR(ui, . . . , v n _ 1} r % o s) = x 

3. (t-robustness.) V^i, . . . , u„_i £E,Vs£S', Vr£i?, if x£ disc t (SRAR(vi } . . . u„_i, ro 
s)), then 

REC(x) = (s,s, . . . ,s) 

A VSS protocol will be composed by two protocols that securely evaluate these two 
functions; the second being evaluated over the output of the first 2 . 

Definition 3 A VSS protocol of fault-tolerance t is a pair of protocols (^Share-Verify , 
Recover^ such that 

• Share-Verify securely evaluates the function y = SHAR(xi, . . . , x n _i, r o s), 

• Recover securely evaluates the function REC(y), and 

• SHAR and REC are a sharing-reconstructing pair with parameter t. 

Remarks: Though the above definition may appear "tailored on some specific VSS 
protocols," in the final paper we shall argue that it does not loose any generality. 

Also, as we shall see below, by demanding that both components (and particularly 
the second one) of a share-reconstructing pair be securely evaluated, we are putting 
an unusually strong requirement on a VSS protocol. But it is exactly this requirement 
that will guarantee the desired reducibility property. 



2 In [4] they use the terminology sequence protocols for this kind of interaction between two 
protocols 
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4 Comparison with previous definitions of VSS 

Let us compare now Definition 3 and Definition f , our token example of prior VSS 
definitions. To begin with, there is a minor syntactical difference between the two 
definitions: according to Definition f when good players find out the dealer is bad 
they just stop playing and output verification = no. In our new definition instead 
the computation goes on, no matter what. This discrepancy can be eliminated by 
having protocols in the hrst definition agree on a default value when the dealer is 
clearly bad and protocols in the second definition always output verification = yes 
at the end of Share-Verify (since we are dealing with a secure funciton evaluation, 
we are guaranteed that all good players will output a common value). 
With these minor changes we can prove the following: 

Theorem 2 If P is a VSS protocol of fault-tolerance t satisfying Definition 3, then 
P is also a protocol of fault-tolerance t satisfying Definition 1. 

Sketch of Proof First, P satisfies the Verihability property of Definition I. Indeed 
because of the t-robustness of the function REC we have that at the end of the phase 
Share-Verify a value a has been fixed and all the good players will output this 
value at the end of the Recover part. This is the value that can be obtained by 
applying the function REC to the output of the function SHAR. Because of the t- 
robustness property it does not matter that t bad players may change their input 
before computing REC. Moreover if the dealer is good this value a is equal to the 
secret s. 

Second, P also satisfies the Unpredictability property of Definition I. Notice 
that because of the t-uniformity property it is impossible (in an information-theoretic 
sense) to predict the secret better than at random for any algorithm that has knowl- 
edge of only I < t components of the output of the function SHAR. Any t-adversary 
has that knowledge but she also has a view of the entire protocol. But here is where 
the secure computation comes to our rescue. Because of the security of the evaluation 
of the function SHAR the adversary can create the entire view by herself using the 
simulator, and so basically the other information is irrelevant. So it's impossible for 
any t-adversary to predict the secret better than at random. 

Details of the proof will be presented in the final paper. ■ 

Are Definitions 3 and I equivalent? That is, if a given VSS protocol P' satisfies 
Definition I, does it also satisfy Definition 3? The answer to this important question, 
provided by the following Theorem 3, is NO. And it better be that way if we want to 
preserve reducibility of VSS protocols. 

Theorem 3 Definition 3 is stricly stronger than Definition 1, that is, there are VSS 
protocols satisfying Definition 1, but not Definition 3. 



We will prove this theorem formally in the final paper, but let us address here some 
of the intuition behind the proof. We start with an easier point. 

Consider a VSS protocol P, satisfying Definition f, in which the secret is a 3- 
colorable graph. During the Recover protocol the graph is reconstructed together 
with a 3-coloring of it kindly provided by the dealer. Notice that Definition f is not 
violated, but notice also that an adversary gains from the execution of such a protocol 
some knowledge about the secret she could not obtain by herself. This in turns means 
that there exists no simulator for this protocol and so that Definition 3 cannot be 
satisfied. And the serious problem with P is that, if used inside a larger protocol in 
which it is crucial that the knowledge of that particular 3-coloring stays hidden, P, 
though "secure" as a VSS protocol on its own, jeopardizes the security of the larger 
protocol. 

This problem with Definition f could be easily solved by substituting property 3 
(unpredictability) with a stronger one based on zero-knowledge and simulatability of 
Share-Verify. In [4] they shortly address this point. But, still, this would not solve 
all the problems. Indeed, another important difference between our definition and 
the previous one is that we require the computation of the function REC to be secure, 
i.e. simulatable. VSS protocols usually perform the Recover phase by having each 
player distribute his share to the others. This is not simulatable. 

Lemma 1 Distributing the shares is not a secure computation of the function REC. 

In other words we want that, when we compute REC(y) over y = SHAR(ui, . . . , u„_i, ro 
s), no knowledge about y should leak except the secret s. The rationale for asking this 
is again the fact that we want our VSS protocols to be secure not just by themselves 
but when used inside subroutines of more complex protocols. Leaking knowledge 
about the shares may create problems to the security of the overall protocol. 

Probably one of the reasons this point was missed before was that in Shamir's 
secret sharing scheme the shares consist of the value of a polynomial of degree t with 
free term s. For a t-adversary who corrupts exactly t players, knowing the secret 
is equivalent to knowing the shares of all players. In fact, knowing the t shares of 
the corrupted players and the secret at the end of Recover, she has t + I points of 
the t-degree polynomial, and by evaluating the so infered polynomial at the names 
of all good players, she easily computes all shares. However, we object that what 
happens to be true for the VSS protocols based on Shamir's scheme, may not be 
true for all VSS protocols. And one should not "wire in" a general definition what 
happens to be true in a specific case. Moreover, even in Shamir-based VSS protocols, 
if the polynomial has degree bigger than the number of corrupted players, then it is 
no longer true that knowledge of the secret is equivalent to knowledge of all shares. 
(In fact, one may even use such a protocol both for verihably secret sharing a given 
value and for, say, flipping a coin.) It is thus needed that the knowledge gainable by 
an adversary at the end of a secure VSS protocol exactly coincides with the original 
secret whenever the dealer is honest. 
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5 A VSS protocol that satisfies our definition 

In the final paper, we shall demonstarte that Rabin's VSS protocol can be modified so 
as to yield a VSS protocol, secure in our sense and with fault-tolerance n/2. For the 
time being, we will be content of exhibiting a simpler VSS protocol secure in our sense 
and with fault-tolerance n/3, by modifying an older protocol of Ben-Or, Goldwasser, 
and Wigderson [1]. The modification actually occurs only in the Recover part, and 
uses techniques also developed by [I], but within their "computational protocol" 
rather than in their VSS protocol. 

Let n = 3t + I and Pi, ... , P n _i, P n = D be the set of players, D being the dealer. 
We will make all our computations modulo a large prime p > 2 2n . Let u be a primitive 
n-th root of the unity in Z v . It is known from the error-correcting codes theory that 
if we evaluate a polynomial / of degree t over the n different points u/ for i = 1, . . . , n 
then given the sequence s 8 - = f(io l ) then we can reconstruct the coefficients of the 
polynomial in polynomial time even if up to t elements in the sequence are arbitrarily 
changed. For details on this error-correcting encoding of a polynomial known as the 
Reed-Solomon code readers can refer to a standard text like [10]. Let m be a security 
parameter. 

Protocol Share-Verify ([1]): 

1. The dealer chooses a random polynomial fo(x) of degree t with the only condi- 
tion that /o(0) = s his secret. Then he sends to player P 8 - the share s 8 - = f (uj l ). 
Moreover he chooses m random polynomials fi , . . . , f m of degree t as well and 
sends to P 8 - the values /j(u/) for each j = 1, . . . , m. 

2. Each player P 8 - broadcasts a random value a 8 - 

3. The dealer broadcasts the polynomials §i = Y^k=o a i fk f° r all j = 1, . . . , m 

4. Player P 8 - checks if the values he holds satisfy the polynomials broadcasted by 
the dealer. If he finds an error he broadcasts a complaint. If more than t + 1 
players complain then the dealer is faulty and all players assume the default 
zero value to be the dealer's secret. 

5. If less than t + 1 players complained the dealer broadcasts the values he sent in 
the hrst round to the players who complained. 

6. Each player P 8 - broadcasts a random value fy 

7. The dealer broadcasts the polynomials hi = Ylk=o fti fk for all j = 1, . . . , m 

8. Player P 8 - checks if the values he holds satisfy the polynomials broadcasted by 
the dealer. If he finds an error he broadcasts a complaint. If more than t + 1 
players complain then the dealer is faulty and all players assume the default 
zero value to be the dealer's secret. 
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Let SHAR be the following function: 

SHAR(ui, v 2 ,..., v n _i, r o s) = (s 1 ,s 2 ,..., s n -i, e) 

with Si = fo{io l ) where fo(x) = s + a\x + . . . + a t x t and r = a,\ o . . . o a^ (i.e. the 
polynomial is created using the coin tosses r of the dealer). Then we can state that 

Lemma 2 Protocol Share-Verify securely evaluates the function SHAR according to 

Definition 2. 

Proof To be presented in the full paper. (No proof of this protocol has yet ap- 
peared.) ■ 

The Recover protocol is modified with respect to the one in [f ] in order to make 
it a secure computation of the function REC. 

Protocol Recover (Modified): 

f . Each player P 8 - chooses random polynomials Pi(x) } qn(x) } . . . , qi m (x) all with free 
term 0. He sends to player P, the values pi(u 3 ), qn(uj 3 ) } . . . , qi m (u 3 ) 

2. Each player P 8 - broadcasts nm random bits y k l 

3. Each player P 8 - broadcasts the following polynomials r 3 = qij + 7^° n pi for each 
3 = l,...,m 

4. Each player P 8 - checks that the information player P^ sent him in round f is 
consistent with what player P^ broadcasted in round 3. If there is a mistake or 
Pfc broadcasted a polynomial with non-zero free term broadcasts bad^ 

5. If there are more than t + I players broadcasting ba (4, player P^ is disqualified 
and all the other players assume to be P^'s share. 

6. Each player P 8 - distributes to all other players the following value s 8 - + P\(lo 1 ) + 
p 2 {^) + • • • + Pniu 1 ) then interpolates the polynomial F(x) = fo(x) -\- p\(x) + 
P2(x) + . . . + p n (x) using the error correcting algorithm of Solomon and Reed. 
The secret will then be s = F{0) = /(0). 

Let REC be the function 

REC(si, . . . , 5 n _i, e) = (s,...,s,s) 

where s is the result of the Solomon- Reed "interpolation" of the s 8 -. 

Lemma 3 Protocol Recover securely evaluates the function REC according to Defi- 
nition 2. 
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Proof Omitted. Will be presented in the full paper. ■ 

And so it follows that 

Theorem 4 The protocol P = (Share — Verify, Recover) is a VSS protocol accord- 
ing to Definition 3 with fault-tolerance ^ 

Sketch of Proof Immediate from Lemmas 2 and 3 once we prove that SHAR and 
REC are a sharing-reconstructing pair of parameter ^. But this is obvious from the 
properties of polynomials and of the Reed-Solomon encoding. Details in the final 
paper. ■ 



6 Conclusion 

In the past cryptographic schemes and protocols used to be considered secure until 
not broken. Due to the increasing use and importance of cryptography, this approach 
is no more acceptable. To call a protocol secure we need a proof of its security. This 
means that we need definitions and methods to be able to prove security. 

Following this philosophy we have presented a new and stronger definition for 
one of the most important cryptographic protocols: Verifiable Secret Sharing. We 
argued that this definition is the correct one especially when VSS is to be used as 
a sub-protocol inside larger protocols (which is probably the most common case for 
VSS). We finally presented a protocol which provably satisfies our new definition. 
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